You are here

class LdapServer in Lightweight Directory Access Protocol (LDAP) 8.2

Same name and namespace in other branches
  1. 7.2 ldap_servers/LdapServer.class.php \LdapServer
  2. 7 ldap_servers/LdapServer.class.php \LdapServer

LDAP Server Class

This class is used to create, work with, and eventually destroy ldap_server objects.

@todo make bindpw protected

Hierarchy

Expanded class hierarchy of LdapServer

2 string references to 'LdapServer'
LdapServerAdmin::getLdapServerObjects in ldap_servers/LdapServerAdmin.class.php
_ldap_servers_get_servers in ldap_servers/ldap_servers.module
see ldap_servers_get_servers()

File

ldap_servers/LdapServer.class.php, line 17
Defines server classes and related functions.

View source
class LdapServer {

  // LDAP Settings
  const LDAP_CONNECT_ERROR = 0x5b;
  const LDAP_SUCCESS = 0x0;
  const LDAP_OPERATIONS_ERROR = 0x1;
  const LDAP_PROTOCOL_ERROR = 0x2;
  public $sid;
  public $numericSid;
  public $name;
  public $status;
  public $ldap_type;
  public $address;
  public $port = 389;
  public $tls = FALSE;
  public $bind_method = 0;
  public $basedn = array();
  public $binddn = FALSE;

  // Default to an anonymous bind.
  public $bindpw = FALSE;

  // Default to an anonymous bind.
  public $user_dn_expression;
  public $user_attr;
  public $account_name_attr;

  //lowercase
  public $mail_attr;

  //lowercase
  public $mail_template;
  public $picture_attr;
  public $unique_persistent_attr;

  //lowercase
  public $unique_persistent_attr_binary = FALSE;
  public $ldapToDrupalUserPhp;
  public $testingDrupalUsername;
  public $testingDrupalUserDn;
  public $detailed_watchdog_log;
  public $editPath;
  public $queriableWithoutUserCredentials = FALSE;

  // can this server be queried without user credentials provided?
  public $userAttributeNeededCache = array();

  // array of attributes needed keyed on $op such as 'user_update'
  public $groupFunctionalityUnused = 0;
  public $groupObjectClass;
  public $groupNested = 0;

  // 1 | 0
  public $groupDeriveFromDn = FALSE;
  public $groupDeriveFromDnAttr = NULL;

  //lowercase
  public $groupUserMembershipsAttrExists = FALSE;

  // does a user attribute containing groups exist?
  public $groupUserMembershipsAttr = NULL;

  //lowercase     // name of user attribute containing groups
  public $groupUserMembershipsConfigured = FALSE;

  // user attribute containing memberships is configured enough to use
  public $groupMembershipsAttr = NULL;

  //lowercase // members, uniquemember, memberUid
  public $groupMembershipsAttrMatchingUserAttr = NULL;

  //lowercase // dn, cn, etc contained in groupMembershipsAttr
  public $groupGroupEntryMembershipsConfigured = FALSE;

  // are groupMembershipsAttrMatchingUserAttr and groupGroupEntryMembershipsConfigured populated
  public $groupTestGroupDn = NULL;
  public $groupTestGroupDnWriteable = NULL;
  private $group_properties = array(
    'groupObjectClass',
    'groupNested',
    'groupDeriveFromDn',
    'groupDeriveFromDnAttr',
    'groupUserMembershipsAttrExists',
    'groupUserMembershipsAttr',
    'groupMembershipsAttrMatchingUserAttr',
    'groupTestGroupDn',
    'groupTestGroupDnWriteable',
  );
  public $paginationEnabled = FALSE;

  // (boolean)(function_exists('ldap_control_paged_result_response') && function_exists('ldap_control_paged_result'));
  public $searchPagination = FALSE;
  public $searchPageSize = 1000;
  public $searchPageStart = 0;
  public $searchPageEnd = NULL;
  public $inDatabase = FALSE;
  public $connection;

  // direct mapping of db to object properties
  public static function field_to_properties_map() {
    return array(
      'sid' => 'sid',
      'numeric_sid' => 'numericSid',
      'name' => 'name',
      'status' => 'status',
      'ldap_type' => 'ldap_type',
      'address' => 'address',
      'port' => 'port',
      'tls' => 'tls',
      'bind_method' => 'bind_method',
      'basedn' => 'basedn',
      'binddn' => 'binddn',
      'user_dn_expression' => 'user_dn_expression',
      'user_attr' => 'user_attr',
      'account_name_attr' => 'account_name_attr',
      'mail_attr' => 'mail_attr',
      'mail_template' => 'mail_template',
      'picture_attr' => 'picture_attr',
      'unique_persistent_attr' => 'unique_persistent_attr',
      'unique_persistent_attr_binary' => 'unique_persistent_attr_binary',
      'ldap_to_drupal_user' => 'ldapToDrupalUserPhp',
      'testing_drupal_username' => 'testingDrupalUsername',
      'testing_drupal_user_dn' => 'testingDrupalUserDn',
      'grp_unused' => 'groupFunctionalityUnused',
      'grp_object_cat' => 'groupObjectClass',
      'grp_nested' => 'groupNested',
      'grp_user_memb_attr_exists' => 'groupUserMembershipsAttrExists',
      'grp_user_memb_attr' => 'groupUserMembershipsAttr',
      'grp_memb_attr' => 'groupMembershipsAttr',
      'grp_memb_attr_match_user_attr' => 'groupMembershipsAttrMatchingUserAttr',
      'grp_derive_from_dn' => 'groupDeriveFromDn',
      'grp_derive_from_dn_attr' => 'groupDeriveFromDnAttr',
      'grp_test_grp_dn' => 'groupTestGroupDn',
      'grp_test_grp_dn_writeable' => 'groupTestGroupDnWriteable',
      'search_pagination' => 'searchPagination',
      'search_page_size' => 'searchPageSize',
    );
  }

  /**
   * Constructor Method
   */
  function __construct($sid) {
    if (!is_scalar($sid)) {
      return;
    }
    $this->detailed_watchdog_log = config('ldap_help.settings')
      ->get('watchdog_detail');
    $server_record = FALSE;
    if (module_exists('ctools')) {
      ctools_include('export');
      $result = ctools_export_load_object('ldap_servers', 'names', array(
        $sid,
      ));
      if (isset($result[$sid])) {
        $server_record = new stdClass();
        foreach ($result[$sid] as $db_field_name => $value) {
          $server_record->{$db_field_name} = $value;
        }
      }

      //debug('ctools record'); debug($server_record);
    }
    else {
      $select = db_select('ldap_servers')
        ->fields('ldap_servers')
        ->condition('ldap_servers.sid', $sid)
        ->execute();
      foreach ($select as $record) {
        if ($record->sid == $sid) {
          $server_record = $record;
        }
      }
    }
    $server_record_bindpw = NULL;
    if (!$server_record) {
      $this->inDatabase = FALSE;
    }
    else {
      $this->inDatabase = TRUE;
      $this->sid = $sid;
      $this->detailedWatchdogLog = config('ldap_help.settings')
        ->get('watchdog_detail');
      foreach ($this
        ->field_to_properties_map() as $db_field_name => $property_name) {
        if (isset($server_record->{$db_field_name})) {
          $this->{$property_name} = $server_record->{$db_field_name};
        }
      }
      $server_record_bindpw = property_exists($server_record, 'bindpw') ? $server_record->bindpw : '';
    }
    $this
      ->initDerivedProperties($server_record_bindpw);
  }

  /**
   * this method sets properties that don't directly map from db record.  it is split out so it can be shared with ldapServerTest.class.php
   */
  protected function initDerivedProperties($bindpw) {

    // get this->basedn in array format
    if (!$this->basedn) {
      $this->basedn = array();
    }
    elseif (is_array($this->basedn)) {

      // do nothing
    }
    else {
      $basedn_unserialized = @unserialize($this->basedn);
      if (is_array($basedn_unserialized)) {
        $this->basedn = $basedn_unserialized;
      }
      else {
        $this->basedn = array();
        $token = is_scalar($basedn_unserialized) ? $basedn_unserialized : print_r($basedn_unserialized, TRUE);
        debug("basednb desearialization error" . $token);
        watchdog('ldap_server', 'Failed to deserialize LdapServer::basedn of !basedn', array(
          '!basedn' => $token,
        ), WATCHDOG_ERROR);
      }
    }
    if ($bindpw) {
      $this->bindpw = ldap_servers_decrypt($bindpw);
    }
    $this->paginationEnabled = (bool) (ldap_servers_php_supports_pagination() && $this->searchPagination);
    $this->queriableWithoutUserCredentials = (bool) ($this->bind_method == LDAP_SERVERS_BIND_METHOD_SERVICE_ACCT || $this->bind_method == LDAP_SERVERS_BIND_METHOD_ANON_USER);
    $this->editPath = !$this->sid ? '' : 'admin/config/people/ldap/servers/edit/' . $this->sid;
    $this->groupGroupEntryMembershipsConfigured = $this->groupMembershipsAttrMatchingUserAttr && $this->groupMembershipsAttr;
    $this->groupUserMembershipsConfigured = $this->groupUserMembershipsAttrExists && $this->groupUserMembershipsAttr;
  }

  /**
   * Destructor Method
   */
  function __destruct() {

    // Close the server connection to be sure.
    $this
      ->disconnect();
  }

  /**
   * Invoke Method
   */
  function __invoke() {
    $this
      ->connect();
    $this
      ->bind();
  }

  /**
   * Connect Method
   */
  function connect() {
    if (!($con = ldap_connect($this->address, $this->port))) {
      watchdog('user', 'LDAP Connect failure to ' . $this->address . ':' . $this->port);
      return LDAP_CONNECT_ERROR;
    }
    ldap_set_option($con, LDAP_OPT_PROTOCOL_VERSION, 3);
    ldap_set_option($con, LDAP_OPT_REFERRALS, 0);

    // Use TLS if we are configured and able to.
    if ($this->tls) {
      ldap_get_option($con, LDAP_OPT_PROTOCOL_VERSION, $vers);
      if ($vers == -1) {
        watchdog('user', 'Could not get LDAP protocol version.');
        return LDAP_PROTOCOL_ERROR;
      }
      if ($vers != 3) {
        watchdog('user', 'Could not start TLS, only supported by LDAP v3.');
        return LDAP_CONNECT_ERROR;
      }
      elseif (!function_exists('ldap_start_tls')) {
        watchdog('user', 'Could not start TLS. It does not seem to be supported by this PHP setup.');
        return LDAP_CONNECT_ERROR;
      }
      elseif (!ldap_start_tls($con)) {
        $msg = t("Could not start TLS. (Error %errno: %error).", array(
          '%errno' => ldap_errno($con),
          '%error' => ldap_error($con),
        ));
        watchdog('user', $msg);
        return LDAP_CONNECT_ERROR;
      }
    }

    // Store the resulting resource
    $this->connection = $con;
    return LDAP_SUCCESS;
  }

  /**
   * Bind (authenticate) against an active LDAP database.
   *
   * @param $userdn
   *   The DN to bind against. If NULL, we use $this->binddn
   * @param $pass
   *   The password search base. If NULL, we use $this->bindpw
   *
   * @return
   *   Result of bind; TRUE if successful, FALSE otherwise.
   */
  function bind($userdn = NULL, $pass = NULL, $anon_bind = FALSE) {

    // Ensure that we have an active server connection.
    if (!$this->connection) {
      watchdog('ldap', "LDAP bind failure for user %user. Not connected to LDAP server.", array(
        '%user' => $userdn,
      ));
      return LDAP_CONNECT_ERROR;
    }
    if ($anon_bind !== FALSE && $userdn === NULL && $pass === NULL && $this->bind_method == LDAP_SERVERS_BIND_METHOD_ANON) {
      $anon_bind = TRUE;
    }
    if ($anon_bind === TRUE) {
      if (@(!ldap_bind($this->connection))) {
        if ($this->detailedWatchdogLog) {
          watchdog('ldap', "LDAP anonymous bind error. Error %errno: %error", array(
            '%errno' => ldap_errno($this->connection),
            '%error' => ldap_error($this->connection),
          ));
        }
        return ldap_errno($this->connection);
      }
    }
    else {
      $userdn = $userdn != NULL ? $userdn : $this->binddn;
      $pass = $pass != NULL ? $pass : $this->bindpw;
      if (drupal_strlen($pass) == 0 || drupal_strlen($userdn) == 0) {
        watchdog('ldap', "LDAP bind failure for user userdn=%userdn, pass=%pass.", array(
          '%userdn' => $userdn,
          '%pass' => $pass,
        ));
        return LDAP_LOCAL_ERROR;
      }
      if (@(!ldap_bind($this->connection, $userdn, $pass))) {
        if ($this->detailedWatchdogLog) {
          watchdog('ldap', "LDAP bind failure for user %user. Error %errno: %error", array(
            '%user' => $userdn,
            '%errno' => ldap_errno($this->connection),
            '%error' => ldap_error($this->connection),
          ));
        }
        return ldap_errno($this->connection);
      }
    }
    return LDAP_SUCCESS;
  }

  /**
   * Disconnect (unbind) from an active LDAP server.
   */
  function disconnect() {
    if (!$this->connection) {

      // never bound or not currently bound, so no need to disconnect

      //watchdog('ldap', 'LDAP disconnect failure from '. $this->server_addr . ':' . $this->port);
    }
    else {
      ldap_unbind($this->connection);
      $this->connection = NULL;
    }
  }
  public function connectAndBindIfNotAlready() {
    if (!$this->connection) {
      $this
        ->connect();
      $this
        ->bind();
    }
  }

  /**
   * does dn exist for this server?
   * [ ] Finished
   * [ ] Test Coverage.  Test ID:
   * [ ] Case insensitive
   *
   * @param string $dn
   * @param enum $return = 'boolean' or 'ldap_entry'
   * @param array $attributes in same form as ldap_read $attributes parameter
   *
   * @param return FALSE or ldap entry array
   */
  function dnExists($dn, $return = 'boolean', $attributes = NULL) {
    $params = array(
      'base_dn' => $dn,
      'attributes' => $attributes,
      'attrsonly' => FALSE,
      'filter' => '(objectclass=*)',
      'sizelimit' => 0,
      'timelimit' => 0,
      'deref' => NULL,
    );
    if ($return == 'boolean' || !is_array($attributes)) {
      $params['attributes'] = array(
        'objectclass',
      );
    }
    else {
      $params['attributes'] = $attributes;
    }
    $result = $this
      ->ldapQuery(LDAP_SCOPE_BASE, $params);
    if ($result !== FALSE) {
      $entries = @ldap_get_entries($this->connection, $result);
      if ($entries !== FALSE && $entries['count'] > 0) {
        return $return == 'boolean' ? TRUE : $entries[0];
      }
    }
    return FALSE;
  }

  /**
   * @param $ldap_result as ldap link identifier
   *
   * @return FALSE on error or number of entries.
   *   (if 0 entries will return 0)
   */
  public function countEntries($ldap_result) {
    return ldap_count_entries($this->connection, $ldap_result);
  }

  /**
  * create ldap entry.
  *
  * @param array $attributes should follow the structure of ldap_add functions
  *   entry array: http://us.php.net/manual/en/function.ldap-add.php
       $attributes["attribute1"] = "value";
       $attributes["attribute2"][0] = "value1";
       $attributes["attribute2"][1] = "value2";
  * @return boolean result
  */
  public function createLdapEntry($attributes, $dn = NULL) {
    if (!$this->connection) {
      $this
        ->connect();
      $this
        ->bind();
    }
    if (isset($attributes['dn'])) {
      $dn = $attributes['dn'];
      unset($attributes['dn']);
    }
    elseif (!$dn) {
      return FALSE;
    }
    $result = @ldap_add($this->connection, $dn, $attributes);
    if (!$result) {
      $error = "LDAP Server ldap_add(%dn) Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
      $tokens = array(
        '%dn' => $dn,
        '%sid' => $this->sid,
        '%ldap_errno' => ldap_errno($this->connection),
        '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)),
      );
      debug(t($error, $tokens));
      watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
    }
    return $result;
  }

  /**
   * given 2 ldap entries, old and new, removed unchanged values to avoid security errors and incorrect date modifieds
   *
   * @param ldap entry array $new_entry in form <attribute> => <value>
   * @param ldap entry array $old_entry in form <attribute> => array('count' => N, array(<value>,...<value>
   *
   * @return ldap array with no values that have NOT changed
   */
  public static function removeUnchangedAttributes($new_entry, $old_entry) {
    foreach ($new_entry as $key => $new_val) {
      $old_value = FALSE;
      $key_lcase = drupal_strtolower($key);
      if (isset($old_entry[$key_lcase])) {
        if ($old_entry[$key_lcase]['count'] == 1) {
          $old_value = $old_entry[$key_lcase][0];
          $old_value_is_scalar = TRUE;
        }
        else {
          unset($old_entry[$key_lcase]['count']);
          $old_value = $old_entry[$key_lcase];
          $old_value_is_scalar = FALSE;
        }
      }

      // identical multivalued attributes
      if (is_array($new_val) && is_array($old_value) && count(array_diff($new_val, $old_value)) == 0) {
        unset($new_entry[$key]);
      }
      elseif ($old_value_is_scalar && !is_array($new_val) && drupal_strtolower($old_value) == drupal_strtolower($new_val)) {
        unset($new_entry[$key]);

        // don't change values that aren't changing to avoid false permission constraints
      }
    }
    return $new_entry;
  }

  /**
  * modify attributes of ldap entry
  *
  * @param string $dn DN of entry
  * @param array $attributes should follow the structure of ldap_add functions
  *   entry array: http://us.php.net/manual/en/function.ldap-add.php
       $attributes["attribute1"] = "value";
       $attributes["attribute2"][0] = "value1";
       $attributes["attribute2"][1] = "value2";

   @return TRUE on success FALSE on error
  */
  function modifyLdapEntry($dn, $attributes = array(), $old_attributes = FALSE) {
    $this
      ->connectAndBindIfNotAlready();
    if (!$old_attributes) {
      $result = @ldap_read($this->connection, $dn, 'objectClass=*');
      if (!$result) {
        $error = "LDAP Server ldap_read(%dn) in LdapServer::modifyLdapEntry() Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
        $tokens = array(
          '%dn' => $dn,
          '%sid' => $this->sid,
          '%ldap_errno' => ldap_errno($this->connection),
          '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)),
        );
        watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
        return FALSE;
      }
      $entries = ldap_get_entries($this->connection, $result);
      if (is_array($entries) && $entries['count'] == 1) {
        $old_attributes = $entries[0];
      }
    }
    $attributes = $this
      ->removeUnchangedAttributes($attributes, $old_attributes);
    foreach ($attributes as $key => $cur_val) {
      $old_value = FALSE;
      $key_lcase = drupal_strtolower($key);
      if (isset($old_attributes[$key_lcase])) {
        if ($old_attributes[$key_lcase]['count'] == 1) {
          $old_value = $old_attributes[$key_lcase][0];
        }
        else {
          unset($old_attributes[$key_lcase]['count']);
          $old_value = $old_attributes[$key_lcase];
        }
      }
      if ($cur_val == '' && $old_value != '') {

        // remove enpty attributes
        unset($attributes[$key]);
        $result = @ldap_mod_del($this->connection, $dn, array(
          $key_lcase => $old_value,
        ));
        if (!$result) {
          $error = "LDAP Server ldap_mod_del(%dn) in LdapServer::modifyLdapEntry() Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
          $tokens = array(
            '%dn' => $dn,
            '%sid' => $this->sid,
            '%ldap_errno' => ldap_errno($this->connection),
            '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)),
          );
          watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
          return FALSE;
        }
      }
      elseif (is_array($cur_val)) {
        foreach ($cur_val as $mv_key => $mv_cur_val) {
          if ($mv_cur_val == '') {
            unset($attributes[$key][$mv_key]);

            // remove empty values in multivalues attributes
          }
          else {
            $attributes[$key][$mv_key] = $mv_cur_val;
          }
        }
      }
    }
    if (count($attributes) > 0) {
      $result = @ldap_modify($this->connection, $dn, $attributes);
      if (!$result) {
        $error = "LDAP Server ldap_modify(%dn) in LdapServer::modifyLdapEntry() Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
        $tokens = array(
          '%dn' => $dn,
          '%sid' => $this->sid,
          '%ldap_errno' => ldap_errno($this->connection),
          '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)),
        );
        watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
        return FALSE;
      }
    }
    return TRUE;
  }

  /**
   * Perform an LDAP delete.
   *
   * @param string $dn
   *
   * @return boolean result per ldap_delete
   */
  public function delete($dn) {
    if (!$this->connection) {
      $this
        ->connect();
      $this
        ->bind();
    }
    $result = @ldap_delete($this->connection, $dn);
    if (!$result) {
      $error = "LDAP Server delete(%dn) in LdapServer::delete() Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
      $tokens = array(
        '%dn' => $dn,
        '%sid' => $this->sid,
        '%ldap_errno' => ldap_errno($this->connection),
        '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)),
      );
      watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
    }
    return $result;
  }

  /**
   * Perform an LDAP search on all base dns and aggregate into one result
   *
   * @param string $filter
   *   The search filter. such as sAMAccountName=jbarclay.  attribute values (e.g. jbarclay) should be esacaped before calling
   * @param array $attributes
   *   List of desired attributes. If omitted, we only return "dn".
   *
   * @remaining params mimick ldap_search() function params
   *
   * @return
   *   An array of matching entries->attributes (will have 0
   *   elements if search returns no results),
   *   or FALSE on error on any of the basedn queries
   */
  public function searchAllBaseDns($filter, $attributes = array(), $attrsonly = 0, $sizelimit = 0, $timelimit = 0, $deref = NULL, $scope = LDAP_SCOPE_SUBTREE) {
    $all_entries = array();
    foreach ($this->basedn as $base_dn) {

      // need to search on all basedns one at a time
      $entries = $this
        ->search($base_dn, $filter, $attributes, $attrsonly, $sizelimit, $timelimit, $deref, $scope);

      // no attributes, just dns needed
      if ($entries === FALSE) {

        // if error in any search, return false
        return FALSE;
      }
      if (count($all_entries) == 0) {
        $all_entries = $entries;
      }
      else {
        $existing_count = $all_entries['count'];
        unset($entries['count']);
        foreach ($entries as $i => $entry) {
          $all_entries[$existing_count + $i] = $entry;
        }
        $all_entries['count'] = count($all_entries);
      }
    }
    return $all_entries;
  }

  /**
   * Perform an LDAP search.
   * @param string $basedn
   *   The search base. If NULL, we use $this->basedn. should not be esacaped
   *
   * @param string $filter
   *   The search filter. such as sAMAccountName=jbarclay.  attribute values (e.g. jbarclay) should be esacaped before calling
   * @param array $attributes
   *   List of desired attributes. If omitted, we only return "dn".
   *
   * @remaining params mimick ldap_search() function params
   *
   * @return
   *   An array of matching entries->attributes (will have 0
   *   elements if search returns no results),
   *   or FALSE on error.
   */
  function search($base_dn = NULL, $filter, $attributes = array(), $attrsonly = 0, $sizelimit = 0, $timelimit = 0, $deref = NULL, $scope = LDAP_SCOPE_SUBTREE) {

    /**
     * pagingation issues:
     * -- see documentation queue: http://markmail.org/message/52w24iae3g43ikix#query:+page:1+mid:bez5vpl6smgzmymy+state:results
     * -- wait for php 5.4? https://svn.php.net/repository/php/php-src/tags/php_5_4_0RC6/NEWS (ldap_control_paged_result
     * -- http://sgehrig.wordpress.com/2009/11/06/reading-paged-ldap-results-with-php-is-a-show-stopper/
     */
    if ($base_dn == NULL) {
      if (count($this->basedn) == 1) {
        $base_dn = $this->basedn[0];
      }
      else {
        return FALSE;
      }
    }
    $attr_display = is_array($attributes) ? join(',', $attributes) : 'none';
    $query = 'ldap_search() call: ' . join(",\n", array(
      'base_dn: ' . $base_dn,
      'filter = ' . $filter,
      'attributes: ' . $attr_display,
      'attrsonly = ' . $attrsonly,
      'sizelimit = ' . $sizelimit,
      'timelimit = ' . $timelimit,
      'deref = ' . $deref,
      'scope = ' . $scope,
    ));
    if ($this->detailed_watchdog_log) {
      watchdog('ldap_server', $query, array());
    }

    // When checking multiple servers, there's a chance we might not be connected yet.
    if (!$this->connection) {
      $this
        ->connect();
      $this
        ->bind();
    }
    $ldap_query_params = array(
      'connection' => $this->connection,
      'base_dn' => $base_dn,
      'filter' => $filter,
      'attributes' => $attributes,
      'attrsonly' => $attrsonly,
      'sizelimit' => $sizelimit,
      'timelimit' => $timelimit,
      'deref' => $deref,
      'query_display' => $query,
      'scope' => $scope,
    );
    if ($this->searchPagination && $this->paginationEnabled) {
      $aggregated_entries = $this
        ->pagedLdapQuery($ldap_query_params);
      return $aggregated_entries;
    }
    else {
      $result = $this
        ->ldapQuery($scope, $ldap_query_params);
      if ($result && $this
        ->countEntries($result) !== FALSE) {
        $entries = ldap_get_entries($this->connection, $result);
        drupal_alter('ldap_server_search_results', $entries, $ldap_query_params);
        return is_array($entries) ? $entries : FALSE;
      }
      elseif ($this
        ->ldapErrorNumber()) {
        $watchdog_tokens = array(
          '%basedn' => $ldap_query_params['base_dn'],
          '%filter' => $ldap_query_params['filter'],
          '%attributes' => print_r($ldap_query_params['attributes'], TRUE),
          '%errmsg' => $this
            ->errorMsg('ldap'),
          '%errno' => $this
            ->ldapErrorNumber(),
        );
        watchdog('ldap', "LDAP ldap_search error. basedn: %basedn| filter: %filter| attributes:\n          %attributes| errmsg: %errmsg| ldap err no: %errno|", $watchdog_tokens);
        return FALSE;
      }
      else {
        return FALSE;
      }
    }
  }

  /**
  * execute a paged ldap query and return entries as one aggregated array
  *
  * $this->searchPageStart and $this->searchPageEnd should be set before calling if
  *   a particular set of pages is desired
  *
  * @param array $ldap_query_params of form:
     'base_dn' => base_dn,
     'filter' =>  filter,
     'attributes' => attributes,
     'attrsonly' => attrsonly,
     'sizelimit' => sizelimit,
     'timelimit' => timelimit,
     'deref' => deref,
     'scope' => scope,

     (this array of parameters is primarily passed on to ldapQuery() method)
  *
  * @return array of ldap entries or FALSE on error.
  *
  */
  public function pagedLdapQuery($ldap_query_params) {
    if (!($this->searchPagination && $this->paginationEnabled)) {
      watchdog('ldap', "LDAP server pagedLdapQuery() called when functionality not available in php install or\n        not enabled in ldap server configuration.  error. basedn: %basedn| filter: %filter| attributes:\n         %attributes| errmsg: %errmsg| ldap err no: %errno|", $watchdog_tokens);
      return FALSE;
    }
    $paged_entries = array();
    $page_token = '';
    $page = 0;
    $estimated_entries = 0;
    $aggregated_entries = array();
    $aggregated_entries_count = 0;
    $has_page_results = FALSE;
    do {
      ldap_control_paged_result($this->connection, $this->searchPageSize, TRUE, $page_token);
      $result = $this
        ->ldapQuery($ldap_query_params['scope'], $ldap_query_params);
      if ($page >= $this->searchPageStart) {
        $skipped_page = FALSE;
        if ($result && $this
          ->countEntries($result) !== FALSE) {
          $page_entries = ldap_get_entries($this->connection, $result);
          unset($page_entries['count']);
          $has_page_results = is_array($page_entries) && count($page_entries) > 0;
          $aggregated_entries = array_merge($aggregated_entries, $page_entries);
          $aggregated_entries_count = count($aggregated_entries);
        }
        elseif ($this
          ->ldapErrorNumber()) {
          $watchdog_tokens = array(
            '%basedn' => $ldap_query_params['base_dn'],
            '%filter' => $ldap_query_params['filter'],
            '%attributes' => print_r($ldap_query_params['attributes'], TRUE),
            '%errmsg' => $this
              ->errorMsg('ldap'),
            '%errno' => $this
              ->ldapErrorNumber(),
          );
          watchdog('ldap', "LDAP ldap_search error. basedn: %basedn| filter: %filter| attributes:\n            %attributes| errmsg: %errmsg| ldap err no: %errno|", $watchdog_tokens);
          return FALSE;
        }
        else {
          return FALSE;
        }
      }
      else {
        $skipped_page = TRUE;
      }
      @ldap_control_paged_result_response($this->connection, $result, $page_token, $estimated_entries);
      if ($ldap_query_params['sizelimit'] && $this
        ->ldapErrorNumber() == LDAP_SIZELIMIT_EXCEEDED) {

        // false positive error thrown.  do not set result limit error when $sizelimit specified
      }
      elseif ($this
        ->hasError()) {
        watchdog('ldap_server', 'ldap_control_paged_result_response() function error. LDAP Error: %message, ldap_list() parameters: %query', array(
          '%message' => $this
            ->errorMsg('ldap'),
          '%query' => $ldap_query_params['query_display'],
        ), WATCHDOG_ERROR);
      }
      if (isset($ldap_query_params['sizelimit']) && $ldap_query_params['sizelimit'] && $aggregated_entries_count >= $ldap_query_params['sizelimit']) {
        $discarded_entries = array_splice($aggregated_entries, $ldap_query_params['sizelimit']);
        break;
      }
      elseif ($this->searchPageEnd !== NULL && $page >= $this->searchPageEnd) {

        // user defined pagination has run out
        break;
      }
      elseif ($page_token === NULL || $page_token == '') {

        // ldap reference pagination has run out
        break;
      }
      $page++;
    } while ($skipped_page || $has_page_results);
    $aggregated_entries['count'] = count($aggregated_entries);
    return $aggregated_entries;
  }

  /**
   * execute ldap query and return ldap records
   *
   * @param scope
   * @params see pagedLdapQuery $params
   *
   * @return array of ldap entries
   */
  function ldapQuery($scope, $params) {
    $this
      ->connectAndBindIfNotAlready();
    switch ($scope) {
      case LDAP_SCOPE_SUBTREE:
        $result = @ldap_search($this->connection, $params['base_dn'], $params['filter'], $params['attributes'], $params['attrsonly'], $params['sizelimit'], $params['timelimit'], $params['deref']);
        if ($params['sizelimit'] && $this
          ->ldapErrorNumber() == LDAP_SIZELIMIT_EXCEEDED) {

          // false positive error thrown.  do not return result limit error when $sizelimit specified
        }
        elseif ($this
          ->hasError()) {
          watchdog('ldap_server', 'ldap_search() function error. LDAP Error: %message, ldap_search() parameters: %query', array(
            '%message' => $this
              ->errorMsg('ldap'),
            '%query' => $params['query_display'],
          ), WATCHDOG_ERROR);
        }
        break;
      case LDAP_SCOPE_BASE:
        $result = @ldap_read($this->connection, $params['base_dn'], $params['filter'], $params['attributes'], $params['attrsonly'], $params['sizelimit'], $params['timelimit'], $params['deref']);
        if ($params['sizelimit'] && $this
          ->ldapErrorNumber() == LDAP_SIZELIMIT_EXCEEDED) {

          // false positive error thrown.  do not result limit error when $sizelimit specified
        }
        elseif ($this
          ->hasError()) {
          watchdog('ldap_server', 'ldap_read() function error.  LDAP Error: %message, ldap_read() parameters: %query', array(
            '%message' => $this
              ->errorMsg('ldap'),
            '%query' => @$params['query_display'],
          ), WATCHDOG_ERROR);
        }
        break;
      case LDAP_SCOPE_ONELEVEL:
        $result = @ldap_list($this->connection, $params['base_dn'], $params['filter'], $params['attributes'], $params['attrsonly'], $params['sizelimit'], $params['timelimit'], $params['deref']);
        if ($params['sizelimit'] && $this
          ->ldapErrorNumber() == LDAP_SIZELIMIT_EXCEEDED) {

          // false positive error thrown.  do not result limit error when $sizelimit specified
        }
        elseif ($this
          ->hasError()) {
          watchdog('ldap_server', 'ldap_list() function error. LDAP Error: %message, ldap_list() parameters: %query', array(
            '%message' => $this
              ->errorMsg('ldap'),
            '%query' => $params['query_display'],
          ), WATCHDOG_ERROR);
        }
        break;
    }
    return $result;
  }

  /**
   * @param array $dns Mixed Case
   * @return array $dns Lower Case
   */
  public function dnArrayToLowerCase($dns) {
    return array_keys(array_change_key_case(array_flip($dns), CASE_LOWER));
  }

  /**
   * @param binary or string $puid as returned from ldap_read or other ldap function
   *
   */
  public function userUserEntityFromPuid($puid) {
    $query = new EntityFieldQuery();
    $query
      ->entityCondition('entity_type', 'user')
      ->fieldCondition('ldap_user_puid_sid', 'value', $this->sid, '=')
      ->fieldCondition('ldap_user_puid', 'value', $puid, '=')
      ->fieldCondition('ldap_user_puid_property', 'value', $this->unique_persistent_attr, '=')
      ->addMetaData('account', user_load(1));

    // run the query as user 1
    $result = $query
      ->execute();
    if (isset($result['user'])) {
      $uids = array_keys($result['user']);
      if (count($uids) == 1) {
        $user = entity_load('user', array_keys($result['user']));
        return $user[$uids[0]];
      }
      else {
        $uids = join(',', $uids);
        $tokens = array(
          '%uids' => $uids,
          '%puid' => $puid,
          '%sid' => $this->sid,
          '%ldap_user_puid_property' => $this->unique_persistent_attr,
        );
        watchdog('ldap_server', 'multiple users (uids: %uids) with same puid (puid=%puid, sid=%sid, ldap_user_puid_property=%ldap_user_puid_property)', $tokens, WATCHDOG_ERROR);
        return FALSE;
      }
    }
    else {
      return FALSE;
    }
  }
  function userUsernameToLdapNameTransform($drupal_username, &$watchdog_tokens) {
    if ($this->ldapToDrupalUserPhp && module_exists('php')) {
      global $name;
      $old_name_value = $name;
      $name = $drupal_username;
      $code = "<?php global \$name; \n" . $this->ldapToDrupalUserPhp . "; \n ?>";
      $watchdog_tokens['%code'] = $this->ldapToDrupalUserPhp;
      $code_result = php_eval($code);
      $watchdog_tokens['%code_result'] = $code_result;
      $ldap_username = $code_result;
      $watchdog_tokens['%ldap_username'] = $ldap_username;
      $name = $old_name_value;

      // important because of global scope of $name
      if ($this->detailedWatchdogLog) {
        watchdog('ldap_server', '%drupal_user_name tansformed to %ldap_username by applying code <code>%code</code>', $watchdog_tokens, WATCHDOG_DEBUG);
      }
    }
    else {
      $ldap_username = $drupal_username;
    }
    return $ldap_username;
  }

  /**
   * @param ldap entry array $ldap_entry
   *
   * @return string user's username value
   */
  public function userUsernameFromLdapEntry($ldap_entry) {
    if ($this->account_name_attr) {
      $accountname = empty($ldap_entry[$this->account_name_attr][0]) ? FALSE : $ldap_entry[$this->account_name_attr][0];
    }
    elseif ($this->user_attr) {
      $accountname = empty($ldap_entry[$this->user_attr][0]) ? FALSE : $ldap_entry[$this->user_attr][0];
    }
    else {
      $accountname = FALSE;
    }
    return $accountname;
  }

  /**
   * @param string $dn ldap dn
   *
   * @return mixed string user's username value of FALSE
   */
  public function userUsernameFromDn($dn) {
    $ldap_entry = @$this
      ->dnExists($dn, 'ldap_entry', array());
    if (!$ldap_entry || !is_array($ldap_entry)) {
      return FALSE;
    }
    else {
      return $this
        ->userUsernameFromLdapEntry($ldap_entry);
    }
  }

  /**
   * @param ldap entry array $ldap_entry
   *
   * @return string user's mail value or FALSE if none present
   */
  public function userEmailFromLdapEntry($ldap_entry) {
    if ($ldap_entry && $this->mail_attr) {

      // not using template
      $mail = isset($ldap_entry[$this->mail_attr][0]) ? $ldap_entry[$this->mail_attr][0] : FALSE;
      return $mail;
    }
    elseif ($ldap_entry && $this->mail_template) {

      // template is of form [cn]@illinois.edu
      ldap_servers_module_load_include('inc', 'ldap_servers', 'ldap_servers.functions');
      return ldap_servers_token_replace($ldap_entry, $this->mail_template, 'ldap_entry');
    }
    else {
      return FALSE;
    }
  }

  /**
   * @param ldap entry array $ldap_entry
   *
   * @return drupal file object image user's thumbnail or FALSE if none present or ERROR happens.
   */
  public function userPictureFromLdapEntry($ldap_entry, $drupal_username = FALSE) {
    if ($ldap_entry && $this->picture_attr) {

      //Check if ldap entry has been provisioned.
      $thumb = isset($ldap_entry[$this->picture_attr][0]) ? $ldap_entry[$this->picture_attr][0] : FALSE;
      if (!$thumb) {
        return false;
      }

      //Create md5 check.
      $md5thumb = md5($thumb);

      /**
       * If existing account already has picture check if it has changed if so remove old file and create the new one
       * If picture is not set but account has md5 something is wrong exit.
       */
      if ($drupal_username && ($account = user_load_by_name($drupal_username))) {
        if ($account->uid == 0 || $account->uid == 1) {
          return false;
        }
        if (isset($account->picture)) {

          // Check if image has changed
          if (isset($account->data['ldap_user']['init']['thumb5md']) && $md5thumb === $account->data['ldap_user']['init']['thumb5md']) {

            //No change return same image
            return $account->picture;
          }
          else {

            //Image is different check wether is obj/str and remove fileobject
            if (is_object($account->picture)) {
              file_delete($account->picture, TRUE);
            }
            elseif (is_string($account->picture)) {
              $file = file_load(intval($account->picture));
              file_delete($file, TRUE);
            }
          }
        }
        elseif (isset($account->data['ldap_user']['init']['thumb5md'])) {
          watchdog('ldap_server', "Some error happened during thumbnailPhoto sync");
          return false;
        }
      }

      //Create tmp file to get image format.
      $filename = uniqid();
      $fileuri = file_directory_temp() . '/' . $filename;
      $size = file_put_contents($fileuri, $thumb);
      $info = image_get_info($fileuri);
      unlink($fileuri);

      // create file object

      //@todo needs to change to reflect new approach to user picture: http://drupal.org/node/1851200
      $file = file_save_data($thumb, 'public://' . variable_get('user_picture_path') . '/' . $filename . '.' . $info['extension']);
      $file->md5Sum = $md5thumb;

      // standard Drupal validators for user pictures

      //@todo needs to change to reflect new approach to user picture: http://drupal.org/node/1851200
      $validators = array(
        'file_validate_is_image' => array(),
        'file_validate_image_resolution' => array(
          variable_get('user_picture_dimensions', '85x85'),
        ),
        'file_validate_size' => array(
          variable_get('user_picture_file_size', '30') * 1024,
        ),
      );
      $errors = file_validate($file, $validators);
      if (empty($errors)) {
        return $file;
      }
      else {
        foreach ($errors as $err => $err_val) {
          watchdog('ldap_server', "Error storing picture: %{$err}", "%{$err_val}", WATCHDOG_ERROR);
        }
        return FALSE;
      }
    }
  }

  /**
   * @param ldap entry array $ldap_entry
   *
   * @return string user's PUID or permanent user id (within ldap), converted from binary, if applicable
   */
  public function userPuidFromLdapEntry($ldap_entry) {
    if ($this->unique_persistent_attr && isset($ldap_entry[$this->unique_persistent_attr][0]) && is_scalar($ldap_entry[$this->unique_persistent_attr][0])) {
      $puid = $ldap_entry[$this->unique_persistent_attr][0];
      return $this->unique_persistent_attr_binary ? ldap_servers_binary($puid) : $puid;
    }
    else {
      return FALSE;
    }
  }

  /**
   *  @param mixed $user
   *    - drupal user object (stdClass Object)
   *    - ldap entry of user (array)
   *    - ldap dn of user (string)
   *    - drupal username of user (string)
   *
   *  @return array $ldap_user_entry (with top level keys of 'dn', 'mail', 'sid' and 'attr' )
   */
  public function user_lookup($user) {
    return $this
      ->userUserToExistingLdapEntry($user);
  }
  public function userUserToExistingLdapEntry($user) {
    if (is_object($user)) {
      $user_ldap_entry = $this
        ->userUserNameToExistingLdapEntry($user->name);
    }
    elseif (is_array($user)) {
      $user_ldap_entry = $user;
    }
    elseif (is_scalar($user)) {
      if (strpos($user, '=') === FALSE) {

        // username
        $user_ldap_entry = $this
          ->userUserNameToExistingLdapEntry($user);
      }
      else {
        $user_ldap_entry = $this
          ->dnExists($user, 'ldap_entry');
      }
    }
    return $user_ldap_entry;
  }

  /**
   * Queries LDAP server for the user.
   *
   * @param string $drupal_user_name
   *
   * @param string or int $prov_event
   *   This could be anything, particularly when used by other modules.  Other modules should use string like 'mymodule_myevent'
   *   LDAP_USER_EVENT_ALL signifies get all attributes needed by all other contexts/ops
   *
   * @return associative array representing ldap data of a user.  for example of returned value.
   *   'sid' => ldap server id
   *   'mail' => derived from ldap mail (not always populated).
   *   'dn'   => dn of user
   *   'attr' => single ldap entry array in form returned from ldap_search() extension, e.g.
   *   'dn' => dn of entry
   */
  function userUserNameToExistingLdapEntry($drupal_user_name, $ldap_context = NULL) {
    $watchdog_tokens = array(
      '%drupal_user_name' => $drupal_user_name,
    );
    $ldap_username = $this
      ->userUsernameToLdapNameTransform($drupal_user_name, $watchdog_tokens);
    if (!$ldap_username) {
      return FALSE;
    }
    if (!$ldap_context) {
      $attributes = array();
    }
    else {
      $attribute_maps = ldap_servers_attributes_needed($this->sid, $ldap_context);
      $attributes = array_keys($attribute_maps);
    }
    foreach ($this->basedn as $basedn) {
      if (empty($basedn)) {
        continue;
      }
      $filter = '(' . $this->user_attr . '=' . ldap_server_massage_text($ldap_username, 'attr_value', LDAP_SERVER_MASSAGE_QUERY_LDAP) . ')';
      $result = $this
        ->search($basedn, $filter, $attributes);
      if (!$result || !isset($result['count']) || !$result['count']) {
        continue;
      }

      // Must find exactly one user for authentication to work.
      if ($result['count'] != 1) {
        $count = $result['count'];
        watchdog('ldap_servers', "Error: !count users found with {$filter} under {$basedn}.", array(
          '!count' => $count,
        ), WATCHDOG_ERROR);
        continue;
      }
      $match = $result[0];

      // These lines serve to fix the attribute name in case a
      // naughty server (i.e.: MS Active Directory) is messing the
      // characters' case.
      // This was contributed by Dan "Gribnif" Wilga, and described
      // here: http://drupal.org/node/87833
      $name_attr = $this->user_attr;
      if (isset($match[$name_attr][0])) {

        // leave name
      }
      elseif (isset($match[drupal_strtolower($name_attr)][0])) {
        $name_attr = drupal_strtolower($name_attr);
      }
      else {
        if ($this->bind_method == LDAP_SERVERS_BIND_METHOD_ANON_USER) {
          $result = array(
            'dn' => $match['dn'],
            'mail' => $this
              ->userEmailFromLdapEntry($match),
            'attr' => $match,
            'sid' => $this->sid,
          );
          return $result;
        }
        else {
          continue;
        }
      }

      // Finally, we must filter out results with spaces added before
      // or after, which are considered OK by LDAP but are no good for us
      // We allow lettercase independence, as requested by Marc Galera
      // on http://drupal.org/node/97728
      //
      // Some setups have multiple $name_attr per entry, as pointed out by
      // Clarence "sparr" Risher on http://drupal.org/node/102008, so we
      // loop through all possible options.
      foreach ($match[$name_attr] as $value) {
        if (drupal_strtolower(trim($value)) == drupal_strtolower($ldap_username)) {
          $result = array(
            'dn' => $match['dn'],
            'mail' => $this
              ->userEmailFromLdapEntry($match),
            'attr' => $match,
            'sid' => $this->sid,
          );
          return $result;
        }
      }
    }
  }

  /**
   * Is a user a member of group?
   *
   * @param string $group_dn MIXED CASE
   * @param mixed $user
   *    - drupal user object (stdClass Object)
   *    - ldap entry of user (array)
   *    - ldap dn of user (array)
   *    - drupal user name (string)
   * @param enum $nested = NULL (default to server configuration), TRUE, or FALSE indicating to test for nested groups
   */
  public function groupIsMember($group_dn, $user, $nested = NULL) {
    $nested = $nested === TRUE || $nested === FALSE ? $nested : $this->groupNested;
    $group_dns = $this
      ->groupMembershipsFromUser($user, 'group_dns', $nested);

    // while list of group dns is going to be in correct mixed case, $group_dn may not since it may be derived from user entered values
    // so make sure in_array() is case insensitive
    return is_array($group_dns) && in_array(drupal_strtolower($group_dn), $this
      ->dnArrayToLowerCase($group_dns));
  }

  /**
   * NOT TESTED
   * add a group entry
   *
   * @param string $group_dn as ldap dn
   * @param array $attributes in key value form
   *    $attributes = array(
   *      "attribute1" = "value",
   *      "attribute2" = array("value1", "value2"),
   *      )
   * @return boolean success
   */
  public function groupAddGroup($group_dn, $attributes = array()) {

    //debug("this->dnExists(   $group_dn, boolean)"); debug($this->dnExists($group_dn, 'boolean'));

    // debug("this->dnExists(   $group_dn, boolean)"); debug($this->dnExists($group_dn));
    if ($this
      ->dnExists($group_dn, 'boolean')) {
      return FALSE;
    }
    $attributes = array_change_key_case($attributes, CASE_LOWER);
    $objectclass = empty($attributes['objectclass']) ? $this->groupObjectClass : $attributes['objectclass'];
    $attributes['objectclass'] = $objectclass;

    /**
     * 2. give other modules a chance to add or alter attributes
     */
    $context = array(
      'action' => 'add',
      'corresponding_drupal_data' => array(
        $group_dn => $attributes,
      ),
      'corresponding_drupal_data_type' => 'group',
    );
    $ldap_entries = array(
      $group_dn => $attributes,
    );
    drupal_alter('ldap_entry_pre_provision', $ldap_entries, $this, $context);
    $attributes = $ldap_entries[$group_dn];

    /**
     * 4. provision ldap entry
     *   @todo how is error handling done here?
     */
    $ldap_entry_created = $this
      ->createLdapEntry($attributes, $group_dn);

    /**
     * 5. allow other modules to react to provisioned ldap entry
     *   @todo how is error handling done here?
     */
    if ($ldap_entry_created) {
      module_invoke_all('ldap_entry_post_provision', $ldap_entries, $this, $context);
      return TRUE;
    }
    else {
      return FALSE;
    }
  }

  /**
   * NOT TESTED
   * remove a group entry
   *
   * @param string $group_dn as ldap dn
   * @param boolean $only_if_group_empty
   *   TRUE = group should not be removed if not empty
   *   FALSE = groups should be deleted regardless of members
   */
  public function groupRemoveGroup($group_dn, $only_if_group_empty = TRUE) {
    if ($only_if_group_empty) {
      $members = $this
        ->groupAllMembers($group_dn);
      if (is_array($members) && count($members) > 0) {
        return FALSE;
      }
    }
    return $this
      ->delete($group_dn);
  }

  /**
   * NOT TESTED
   * add a member to a group
   *
   * @param string $ldap_user_dn as ldap dn
   * @param mixed $user
   *    - drupal user object (stdClass Object)
   *    - ldap entry of user (array) (with top level keys of 'dn', 'mail', 'sid' and 'attr' )
   *    - ldap dn of user (array)
   *    - drupal username of user (string)
   */
  public function groupAddMember($group_dn, $user) {
    $user_ldap_entry = $this
      ->userUserToExistingLdapEntry($user);
    $result = FALSE;
    if ($user_ldap_entry && $this->groupGroupEntryMembershipsConfigured) {
      $add = array();
      $add[$this->groupMembershipsAttr] = $user_ldap_entry['dn'];
      $this
        ->connectAndBindIfNotAlready();
      $result = @ldap_mod_add($this->connection, $group_dn, $add);
    }
    return $result;
  }

  /**
   * NOT TESTED
   * remove a member from a group
   *
   * @param string $group_dn as ldap dn
   * @param mixed $user
   *    - drupal user object (stdClass Object)
   *    - ldap entry of user (array) (with top level keys of 'dn', 'mail', 'sid' and 'attr' )
   *    - ldap dn of user (array)
   *    - drupal username of user (string)
   */
  public function groupRemoveMember($group_dn, $user) {
    $user_ldap_entry = $this
      ->userUserToExistingLdapEntry($user);
    $result = FALSE;
    if ($user_ldap_entry && $this->groupGroupEntryMembershipsConfigured) {
      $del = array();
      $del[$this->groupMembershipsAttr] = $user_ldap_entry['dn'];
      $this
        ->connectAndBindIfNotAlready();
      $result = @ldap_mod_del($this->connection, $group_dn, $del);
    }
    return $result;
  }

  /**
   *
   * @todo: NOT IMPLEMENTED: nested groups
   *
   * get all members of a group
   *
   * @param string $group_dn as ldap dn
   *
   * @return FALSE on error otherwise array of group members (could be users or groups)
   */
  public function groupAllMembers($group_dn) {

    // debug("groupAllMembers $group_dn, this->groupMembershipsAttr=". $this->groupMembershipsAttr . 'this->groupGroupEntryMembershipsConfigured=' . $this->groupGroupEntryMembershipsConfigured);
    if (!$this->groupGroupEntryMembershipsConfigured) {
      return FALSE;
    }
    $attributes = array(
      $this->groupMembershipsAttr,
      'cn',
    );
    $group_entry = $this
      ->dnExists($group_dn, 'ldap_entry', $attributes);
    if (!$group_entry) {
      return FALSE;
    }
    else {
      if (empty($group_entry['cn'])) {

        // if attributes weren't returned, don't give false  empty group
        return FALSE;
      }
      if (empty($group_entry[$this->groupMembershipsAttr])) {
        return array();

        // if no attribute returned, no members
      }
      $members = $group_entry[$this->groupMembershipsAttr];
      if (isset($members['count'])) {
        unset($members['count']);
      }
      return $members;
    }
    $this
      ->groupMembersResursive($current_group_entries, $all_group_dns, $tested_group_ids, 0, $max_levels, $object_classes);
    return $all_group_dns;
  }

  /**
   *   NOT IMPLEMENTED
   * recurse through all child groups and add members.
   *
   * @param array $current_group_entries of ldap group entries that are starting point.  should include at least 1 entry.
   * @param array $all_group_dns as array of all groups user is a member of.  MIXED CASE VALUES
   * @param array $tested_group_ids as array of tested group dn, cn, uid, etc.  MIXED CASE VALUES
   *   whether these value are dn, cn, uid, etc depends on what attribute members, uniquemember, memberUid contains
   *   whatever attribute is in $this->$tested_group_ids to avoid redundant recursing
   * @param int $level of recursion
   * @param int $max_levels as max recursion allowed
   *
   */
  public function groupMembersResursive($current_member_entries, &$all_member_dns, &$tested_group_ids, $level, $max_levels, $object_classes = FALSE) {
    if (!$this->groupGroupEntryMembershipsConfigured || !is_array($current_member_entries) || count($current_member_entries) == 0) {
      return FALSE;
    }
    if (isset($current_member_entries['count'])) {
      unset($current_member_entries['count']);
    }
    foreach ($current_member_entries as $i => $member_entry) {

      //dpm("groupMembersResursive:member_entry $i, level=$level < max_levels=$max_levels"); dpm($member_entry);

      // 1.  Add entry itself if of the correct type to $all_member_dns
      $objectClassMatch = !$object_classes || count(array_intersect(array_values($member_entry['objectclass']), $object_classes)) > 0;
      $objectIsGroup = in_array($this->groupObjectClass, array_values($member_entry['objectclass']));
      if ($objectClassMatch && !in_array($member_entry['dn'], $all_member_dns)) {

        // add member
        $all_member_dns[] = $member_entry['dn'];
      }

      // 2. If its a group, keep recurse the group for descendants
      if ($objectIsGroup && $level < $max_levels) {
        if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
          $group_id = $member_entry['dn'];
        }
        else {
          $group_id = $member_entry[$this->groupMembershipsAttrMatchingUserAttr][0];
        }

        // 3. skip any groups that have already been tested
        if (!in_array($group_id, $tested_group_ids)) {
          $tested_group_ids[] = $group_id;
          $member_ids = $member_entry[$this->groupMembershipsAttr];
          if (isset($member_ids['count'])) {
            unset($member_ids['count']);
          }
          $ors = array();
          foreach ($member_ids as $i => $member_id) {
            $ors[] = $this->groupMembershipsAttr . '=' . $member_id;

            // @todo this would be replaced by query template
          }
          if (count($ors)) {
            $query_for_child_members = '(|(' . join(")(", $ors) . '))';

            // e.g. (|(cn=group1)(cn=group2)) or   (|(dn=cn=group1,ou=blah...)(dn=cn=group2,ou=blah...))
            if (count($object_classes)) {

              // add or on object classe, otherwise get all object classes
              $object_classes_ors = array(
                '(objectClass=' . $this->groupObjectClass . ')',
              );
              foreach ($object_classes as $object_class) {
                $object_classes_ors[] = '(objectClass=' . $object_class . ')';
              }
              $query_for_child_members = '&(|' . join($object_classes_ors) . ')(' . $query_for_child_members . ')';
            }
            foreach ($this->basedn as $base_dn) {

              // need to search on all basedns one at a time
              $child_member_entries = $this
                ->search($base_dn, $query_for_child_members, array(
                'objectclass',
                $this->groupMembershipsAttr,
                $this->groupMembershipsAttrMatchingUserAttr,
              ));
              if ($child_member_entries !== FALSE) {
                $this
                  ->groupMembersResursive($child_member_entries, $all_member_dns, $tested_group_ids, $level + 1, $max_levels, $object_classes);
              }
            }
          }
        }
      }
    }
  }

  /**
    /**
  *  get list of all groups that a user is a member of.
  *
  *    If $nested = TRUE,
  *    list will include all parent group.  That is if user is a member of "programmer" group
  *    and "programmer" group is a member of "it" group, user is a member of
  *    both "programmer" and "it" groups.
  *
  *    If $nested = FALSE, list will only include groups user is in directly.
  *
  *  @param mixed
  *    - drupal user object (stdClass Object)
  *    - ldap entry of user (array) (with top level keys of 'dn', 'mail', 'sid' and 'attr' )
  *    - ldap dn of user (array)
  *    - drupal username of user (string)
  *  @param enum $return = 'group_dns'
  *  @param boolean $nested if groups should be recursed or not.
  *
  *  @return array of groups dns in mixed case or FALSE on error
  */
  public function groupMembershipsFromUser($user, $return = 'group_dns', $nested = NULL) {
    $group_dns = FALSE;
    $user_ldap_entry = @$this
      ->userUserToExistingLdapEntry($user);
    if (!$user_ldap_entry || $this->groupFunctionalityUnused) {
      return FALSE;
    }
    if ($nested === NULL) {
      $nested = $this->groupNested;
    }
    if ($this->groupUserMembershipsConfigured) {

      // preferred method
      $group_dns = $this
        ->groupUserMembershipsFromUserAttr($user_ldap_entry, $nested);
    }
    elseif ($this->groupGroupEntryMembershipsConfigured) {
      $group_dns = $this
        ->groupUserMembershipsFromEntry($user_ldap_entry, $nested);
    }
    if ($return == 'group_dns') {
      return $group_dns;
    }
  }

  /**
   *  get list of all groups that a user is a member of by using memberOf attribute first,
   *    then if nesting is true, using group entries to find parent groups
   *
   *    If $nested = TRUE,
   *    list will include all parent group.  That is if user is a member of "programmer" group
   *    and "programmer" group is a member of "it" group, user is a member of
   *    both "programmer" and "it" groups.
   *
   *    If $nested = FALSE, list will only include groups user is in directly.
   *
   *  @param mixed
   *    - drupal user object (stdClass Object)
   *    - ldap entry of user (array) (with top level keys of 'dn', 'mail', 'sid' and 'attr' )
   *    - ldap dn of user (array)
   *    - drupal username of user (string)
   *  @param boolean $nested if groups should be recursed or not.
   *
   *  @return array of group dns
   */
  public function groupUserMembershipsFromUserAttr($user, $nested = NULL) {
    if (!$this->groupUserMembershipsConfigured) {
      return FALSE;
    }
    if ($nested === NULL) {
      $nested = $this->groupNested;
    }
    $not_user_ldap_entry = empty($user['attr'][$this->groupUserMembershipsAttr]);
    if ($not_user_ldap_entry) {

      // if drupal user passed in, try to get user_ldap_entry
      $user = $this
        ->userUserToExistingLdapEntry($user);
      $not_user_ldap_entry = empty($user['attr'][$this->groupUserMembershipsAttr]);
      if ($not_user_ldap_entry) {
        return FALSE;

        // user's membership attribute is not present.  either misconfigured or query failed
      }
    }

    // if not exited yet, $user must be user_ldap_entry.
    $user_ldap_entry = $user;
    $all_group_dns = array();
    $tested_group_ids = array();
    $level = 0;
    $member_group_dns = $user_ldap_entry['attr'][$this->groupUserMembershipsAttr];
    if (isset($member_group_dns['count'])) {
      unset($member_group_dns['count']);
    }
    $ors = array();
    foreach ($member_group_dns as $i => $member_group_dn) {
      $all_group_dns[] = $member_group_dn;
      if ($nested) {
        if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
          $member_value = $member_group_dn;
        }
        else {
          $member_value = ldap_servers_get_first_rdn_value_from_dn($member_group_dn, $this->groupMembershipsAttrMatchingUserAttr);
        }
        $ors[] = $this->groupMembershipsAttr . '=' . $member_value;
      }
    }
    if ($nested && count($ors)) {
      $count = count($ors);
      for ($i = 0; $i < $count; $i = $i + LDAP_SERVER_LDAP_QUERY_CHUNK) {

        // only 50 or so per query
        $current_ors = array_slice($ors, $i, LDAP_SERVER_LDAP_QUERY_CHUNK);
        $or = '(|(' . join(")(", $current_ors) . '))';

        // e.g. (|(cn=group1)(cn=group2)) or   (|(dn=cn=group1,ou=blah...)(dn=cn=group2,ou=blah...))
        $query_for_parent_groups = '(&(objectClass=' . $this->groupObjectClass . ')' . $or . ')';
        foreach ($this->basedn as $base_dn) {

          // need to search on all basedns one at a time
          // debug("query for parent groups, base_dn=$base_dn, $query_for_parent_groups");
          $group_entries = $this
            ->search($base_dn, $query_for_parent_groups);

          // no attributes, just dns needed
          if ($group_entries !== FALSE && $level < LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT) {
            $this
              ->groupMembershipsFromEntryResursive($group_entries, $all_group_dns, $tested_group_ids, $level + 1, LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT);
          }
        }
      }
    }
    return $all_group_dns;
  }

  /**
   *  get list of all groups that a user is a member of by querying groups
   *
   *    If $nested = TRUE,
   *    list will include all parent group.  That is if user is a member of "programmer" group
   *    and "programmer" group is a member of "it" group, user is a member of
   *    both "programmer" and "it" groups.
   *
   *    If $nested = FALSE, list will only include groups user is in directly.
   *
   *  @param mixed
   *    - drupal user object (stdClass Object)
   *    - ldap entry of user (array) (with top level keys of 'dn', 'mail', 'sid' and 'attr' )
   *    - ldap dn of user (array)
   *    - drupal username of user (string)
   *  @param boolean $nested if groups should be recursed or not.
   *
   *  @return array of group dns MIXED CASE VALUES
   *
   *  @see tests/DeriveFromEntry/ldap_servers.inc for fuller notes and test example
   */
  public function groupUserMembershipsFromEntry($user, $nested = NULL) {
    if (!$this->groupGroupEntryMembershipsConfigured) {
      return FALSE;
    }
    if ($nested === NULL) {
      $nested = $this->groupNested;
    }
    $user_ldap_entry = $this
      ->userUserToExistingLdapEntry($user);
    $all_group_dns = array();

    // MIXED CASE VALUES
    $tested_group_ids = array();

    // array of dns already tested to avoid excess queries MIXED CASE VALUES
    $level = 0;
    if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
      $member_value = $user_ldap_entry['dn'];
    }
    else {
      $member_value = $user_ldap_entry['attr'][$this->groupMembershipsAttrMatchingUserAttr][0];
    }
    $group_query = '(&(objectClass=' . $this->groupObjectClass . ')(' . $this->groupMembershipsAttr . "={$member_value}))";
    foreach ($this->basedn as $base_dn) {

      // need to search on all basedns one at a time
      $group_entries = $this
        ->search($base_dn, $group_query, array());

      // only need dn, so empty array forces return of no attributes
      if ($group_entries !== FALSE) {
        $max_levels = $nested ? LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT : 0;
        $this
          ->groupMembershipsFromEntryResursive($group_entries, $all_group_dns, $tested_group_ids, $level, $max_levels);
      }
    }
    return $all_group_dns;
  }

  /**
   * recurse through all groups, adding parent groups to $all_group_dns array.
   *
   * @param array $current_group_entries of ldap group entries that are starting point.  should include at least 1 entry.
   * @param array $all_group_dns as array of all groups user is a member of.  MIXED CASE VALUES
   * @param array $tested_group_ids as array of tested group dn, cn, uid, etc.  MIXED CASE VALUES
   *   whether these value are dn, cn, uid, etc depends on what attribute members, uniquemember, memberUid contains
   *   whatever attribute is in $this->$tested_group_ids to avoid redundant recursing
   * @param int $level of recursion
   * @param int $max_levels as max recursion allowed
   *
   * given set of groups entries ($current_group_entries such as it, hr, accounting),
   * find parent groups (such as staff, people, users) and add them to list of group memberships ($all_group_dns)
   *
   * (&(objectClass=[$this->groupObjectClass])(|([$this->groupMembershipsAttr]=groupid1)([$this->groupMembershipsAttr]=groupid2))
   *
   * @return FALSE for error or misconfiguration, otherwise TRUE.  results are passed by reference.
   */
  public function groupMembershipsFromEntryResursive($current_group_entries, &$all_group_dns, &$tested_group_ids, $level, $max_levels) {
    if (!$this->groupGroupEntryMembershipsConfigured || !is_array($current_group_entries) || count($current_group_entries) == 0) {
      return FALSE;
    }
    if (isset($current_group_entries['count'])) {
      unset($current_group_entries['count']);
    }
    $ors = array();
    foreach ($current_group_entries as $i => $group_entry) {
      if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
        $member_id = $group_entry['dn'];
      }
      else {

        // maybe cn, uid, etc is held
        $member_id = ldap_servers_get_first_rdn_value_from_dn($group_entry['dn'], $this->groupMembershipsAttrMatchingUserAttr);
      }
      if ($member_id && !in_array($member_id, $tested_group_ids)) {
        $tested_group_ids[] = $member_id;
        $all_group_dns[] = $group_entry['dn'];

        // add $group_id (dn, cn, uid) to query
        $ors[] = $this->groupMembershipsAttr . '=' . $member_id;
      }
    }
    if (count($ors)) {
      $count = count($ors);
      for ($i = 0; $i < $count; $i = $i + LDAP_SERVER_LDAP_QUERY_CHUNK) {

        // only 50 or so per query
        $current_ors = array_slice($ors, $i, LDAP_SERVER_LDAP_QUERY_CHUNK);
        $or = '(|(' . join(")(", $current_ors) . '))';

        // e.g. (|(cn=group1)(cn=group2)) or   (|(dn=cn=group1,ou=blah...)(dn=cn=group2,ou=blah...))
        $query_for_parent_groups = '(&(objectClass=' . $this->groupObjectClass . ')' . $or . ')';
        foreach ($this->basedn as $base_dn) {

          // need to search on all basedns one at a time
          $group_entries = $this
            ->search($base_dn, $query_for_parent_groups);

          // no attributes, just dns needed
          if ($group_entries !== FALSE && $level < $max_levels) {
            $this
              ->groupMembershipsFromEntryResursive($group_entries, $all_group_dns, $tested_group_ids, $level + 1, $max_levels);
          }
        }
      }
    }
    return TRUE;
  }

  /**
   *  get "groups" from derived from DN.  Has limited usefulness
   *
   *  @param mixed
   *    - drupal user object (stdClass Object)
   *    - ldap entry of user (array) (with top level keys of 'dn', 'mail', 'sid' and 'attr' )
   *    - ldap dn of user (array)
   *    - drupal username of user (string)
   *
   *  @return array of group strings
   */
  public function groupUserMembershipsFromDn($user) {
    if (!$this->groupDeriveFromDn || !$this->groupDeriveFromDnAttr) {
      return FALSE;
    }
    elseif ($user_ldap_entry = $this
      ->userUserToExistingLdapEntry($user)) {
      return ldap_servers_get_all_rdn_values_from_dn($user_ldap_entry['dn'], $this->groupDeriveFromDnAttr);
    }
    else {
      return FALSE;
    }
  }

  /**
   * Error methods and properties.
   */
  public $detailedWatchdogLog = FALSE;
  protected $_errorMsg = NULL;
  protected $_hasError = FALSE;
  protected $_errorName = NULL;
  public function setError($_errorName, $_errorMsgText = NULL) {
    $this->_errorMsgText = $_errorMsgText;
    $this->_errorName = $_errorName;
    $this->_hasError = TRUE;
  }
  public function clearError() {
    $this->_hasError = FALSE;
    $this->_errorMsg = NULL;
    $this->_errorName = NULL;
  }
  public function hasError() {
    return $this->_hasError || $this
      ->ldapErrorNumber();
  }
  public function errorMsg($type = NULL) {
    if ($type == 'ldap' && $this->connection) {
      return ldap_err2str(ldap_errno($this->connection));
    }
    elseif ($type == NULL) {
      return $this->_errorMsg;
    }
    else {
      return NULL;
    }
  }
  public function errorName($type = NULL) {
    if ($type == 'ldap' && $this->connection) {
      return "LDAP Error: " . ldap_error($this->connection);
    }
    elseif ($type == NULL) {
      return $this->_errorName;
    }
    else {
      return NULL;
    }
  }
  public function ldapErrorNumber() {
    if ($this->connection && ldap_errno($this->connection)) {
      return ldap_errno($this->connection);
    }
    else {
      return FALSE;
    }
  }

}

Members

Namesort descending Modifiers Type Description Overrides
LdapServer::$account_name_attr public property
LdapServer::$address public property
LdapServer::$basedn public property
LdapServer::$binddn public property 1
LdapServer::$bindpw public property 1
LdapServer::$bind_method public property
LdapServer::$connection public property
LdapServer::$detailedWatchdogLog public property Error methods and properties.
LdapServer::$detailed_watchdog_log public property
LdapServer::$editPath public property
LdapServer::$groupDeriveFromDn public property
LdapServer::$groupDeriveFromDnAttr public property
LdapServer::$groupFunctionalityUnused public property
LdapServer::$groupGroupEntryMembershipsConfigured public property
LdapServer::$groupMembershipsAttr public property
LdapServer::$groupMembershipsAttrMatchingUserAttr public property
LdapServer::$groupNested public property
LdapServer::$groupObjectClass public property
LdapServer::$groupTestGroupDn public property
LdapServer::$groupTestGroupDnWriteable public property
LdapServer::$groupUserMembershipsAttr public property
LdapServer::$groupUserMembershipsAttrExists public property
LdapServer::$groupUserMembershipsConfigured public property
LdapServer::$group_properties private property
LdapServer::$inDatabase public property
LdapServer::$ldapToDrupalUserPhp public property
LdapServer::$ldap_type public property
LdapServer::$mail_attr public property
LdapServer::$mail_template public property
LdapServer::$name public property
LdapServer::$numericSid public property
LdapServer::$paginationEnabled public property
LdapServer::$picture_attr public property
LdapServer::$port public property
LdapServer::$queriableWithoutUserCredentials public property
LdapServer::$searchPageEnd public property
LdapServer::$searchPageSize public property
LdapServer::$searchPageStart public property
LdapServer::$searchPagination public property
LdapServer::$sid public property
LdapServer::$status public property
LdapServer::$testingDrupalUserDn public property
LdapServer::$testingDrupalUsername public property
LdapServer::$tls public property
LdapServer::$unique_persistent_attr public property
LdapServer::$unique_persistent_attr_binary public property
LdapServer::$userAttributeNeededCache public property
LdapServer::$user_attr public property
LdapServer::$user_dn_expression public property
LdapServer::$_errorMsg protected property
LdapServer::$_errorName protected property
LdapServer::$_hasError protected property
LdapServer::bind function * Bind (authenticate) against an active LDAP database. * * 1
LdapServer::clearError public function
LdapServer::connect function Connect Method 1
LdapServer::connectAndBindIfNotAlready public function
LdapServer::countEntries public function 1
LdapServer::createLdapEntry public function create ldap entry. 1
LdapServer::delete public function Perform an LDAP delete. 2
LdapServer::disconnect function Disconnect (unbind) from an active LDAP server. 1
LdapServer::dnArrayToLowerCase public function
LdapServer::dnExists function does dn exist for this server? [ ] Finished [ ] Test Coverage. Test ID: [ ] Case insensitive 1
LdapServer::errorMsg public function
LdapServer::errorName public function
LdapServer::field_to_properties_map public static function
LdapServer::groupAddGroup public function NOT TESTED add a group entry
LdapServer::groupAddMember public function NOT TESTED add a member to a group
LdapServer::groupAllMembers public function @todo: NOT IMPLEMENTED: nested groups
LdapServer::groupIsMember public function Is a user a member of group?
LdapServer::groupMembershipsFromEntryResursive public function recurse through all groups, adding parent groups to $all_group_dns array.
LdapServer::groupMembershipsFromUser public function get list of all groups that a user is a member of.
LdapServer::groupMembersResursive public function NOT IMPLEMENTED recurse through all child groups and add members.
LdapServer::groupRemoveGroup public function NOT TESTED remove a group entry
LdapServer::groupRemoveMember public function NOT TESTED remove a member from a group
LdapServer::groupUserMembershipsFromDn public function get "groups" from derived from DN. Has limited usefulness
LdapServer::groupUserMembershipsFromEntry public function get list of all groups that a user is a member of by querying groups
LdapServer::groupUserMembershipsFromUserAttr public function get list of all groups that a user is a member of by using memberOf attribute first, then if nesting is true, using group entries to find parent groups
LdapServer::hasError public function
LdapServer::initDerivedProperties protected function this method sets properties that don't directly map from db record. it is split out so it can be shared with ldapServerTest.class.php
LdapServer::ldapErrorNumber public function
LdapServer::ldapQuery function execute ldap query and return ldap records
LdapServer::LDAP_CONNECT_ERROR constant
LdapServer::LDAP_OPERATIONS_ERROR constant
LdapServer::LDAP_PROTOCOL_ERROR constant
LdapServer::LDAP_SUCCESS constant
LdapServer::modifyLdapEntry function modify attributes of ldap entry 1
LdapServer::pagedLdapQuery public function execute a paged ldap query and return entries as one aggregated array
LdapServer::removeUnchangedAttributes public static function given 2 ldap entries, old and new, removed unchanged values to avoid security errors and incorrect date modifieds
LdapServer::search function Perform an LDAP search. 1
LdapServer::searchAllBaseDns public function Perform an LDAP search on all base dns and aggregate into one result
LdapServer::setError public function
LdapServer::userEmailFromLdapEntry public function
LdapServer::userPictureFromLdapEntry public function *
LdapServer::userPuidFromLdapEntry public function
LdapServer::userUserEntityFromPuid public function
LdapServer::userUsernameFromDn public function
LdapServer::userUsernameFromLdapEntry public function
LdapServer::userUserNameToExistingLdapEntry function Queries LDAP server for the user.
LdapServer::userUsernameToLdapNameTransform function
LdapServer::userUserToExistingLdapEntry public function
LdapServer::user_lookup public function
LdapServer::__construct function Constructor Method 2
LdapServer::__destruct function Destructor Method 1
LdapServer::__invoke function Invoke Method